Malwarebytes blocking outbound website 88.214.193.211

[pldreier]

I have a pc that has started acting up - IE randomly opening up with random websites, running very slow, etc. I have run Malwarebytes, Kaspersky and use ESET antivirus but none of these find anything. Malwarebytes keeps popping up letting me know that is it blocking a malicious website (88.214.193.211) when IE is not even running.

 

I followed the steps under the forum "I'm infected - What do I do now" and ran farbar recovery tool. The log files it created are attached.

 

Hope you can help me.

thanks

Addition.txt

FRST.txt

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

 

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

 

Next,

 

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Next,

 

Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

 

 

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

 

When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

 

 

In most cases, a restart will be required.

 

 

Wait for the prompt to restart the computer to appear, then click on Yes.

 

 

Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

 

Next,

 

Download AdwCleaner by Xplode onto your Desktop.

• 
  

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

 

Next,

 

Please download Junkware Removal Tool to your desktop.

• 
  

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

Next,

 

Download Dr Web Cureit from here http://www.freedrweb.com/cureit save to your desktop. (Scroll to bottom of page)

 

• The file will be randomly named
  
• Reboot to safe mode
  
• Run Dr Web
  
• Tick the I agree box and select continue
  
• Click select objects for scanning
   
  
   
  
• Tick all boxes as shown
  
• Click the wrench and select automatically apply actions to threats
   
  
   
  
• Press start scan
  
• The scan will now commence
   
  
   
  
• Once the scan has finished click open report
   
  
   
  
• A notepad will open
  
• Select File > Save as..
  
• Save it to your desktop
  

 

This log will be excessive,  Attach it to your next reply…

 

Let me see those logs in your next reply, also give an update on any remaining issues or conceerns....

 

Kevin....

 

 

 

 

 

Fixlist.txt

[pldreier]

I was able to do almost everything. I could not download and run drwebcureit (tried in safe and normal modes. It wouldn't download). Here is everything else:

Malwarebytes log: I have attached as a txt file because unable to paste from clipboard

adwcleaner log: again attached because unable to paste

Junkware removal log: attached - same issue (very sorry...)

malwarelog.txt

AdwCleanerS0.txt

JRT.txt

[kevinf80]

What about the first step?

[pldreier]

sorry - I did it first just forgot to attach. Attached now

Fixlog.txt

[kevinf80]

We still need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:

 

Run Eset Online Scanner

 

**Note** You will need to use Internet explorer for this scan - Vista and Windows 7/8 right click on IE shortcut and run as admin.

 

(To run ESET Online Scanner in a browser other than Internet Explorer, you'll need to download ESET SMART  Installer during the process)

 

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

 

• 
  

Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option "Remove found threats"  is UNticked
Click on Advanced Settings, ensure the following options are checked:
 
Scan for potentially unsafe applications
Enable Anti-Stealth Technology
 
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish

 

When the scan is complete

 

• 
  

If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found

 

If threats were found

 

• 
  

click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish

 

close program

 

Copy and paste the report in next reply, also give an update on any remaining issues or concerns..

 

Kevin...

[pldreier]

ESET Online scan found one threat. log is attached (for some reason I can not do any copy and paste functions here)

 

Malwarebytes is still blocking the same outbound IP every couple of minutes.

 

IE locking up very frequently and requiring a restart

Thanks

 

eset scan.txt

[kevinf80]

ESET log entry is safe, nothing to worry about.. run the following, let me know if the outbound IP block ceases...

 

Scan with ZOEK

 

Please download ZOEK by Smeenk from here: http://hijackthis.nl/smeenk/ and save it to your desktop (preferred version is the *.exe one)

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

 

• 
  

Right-click on icon and select Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.
In the main box please paste in the following script:

 

services_list;standardsearch;autoclean;emptyclsid;emptyfolderscheck;deleteiedefaults;firefoxlook;chromelook;FFdefaults;CHRdefaults;

 

 

• 
  

Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

 

Please include its content in your next reply.

Don't forget to re-enable your switched-off protection software!

 

Thanks,

 

Kevin...

[pldreier]

attached is the log from ZOEK

 

Still getting pop up that blocking same outbound IP

 

Thanks

zoek-results.txt

[kevinf80]

Do the following links give any information that you recognize related to the blocked IP..

 

http://www.ip-adress.com/ip_tracer/88.214.193.211

 

http://www.ip-adress.com/whois/88.214.193.211

 

Next,

 

I want you to restart your system in a "clean boot mode" basically this will disable all non microsoft services, make sure your security is left active if listed....

See if the IP block occurs in that mode, instructions are at the following link, expand the option for Windows 7...

 

http://support.microsoft.com/kb/929135

 

Thanks,

 

Kevin...

[pldreier]

The warning blocking the IP address seems to have stopped. Have not had it pop up for several days. PC seems to still run slow and today got an "application security warning"  that couldn't start an application because too many things were already running. The only applications started were Outlook 2013 and Excel 2013.

 

Thanks

[kevinf80]

If the clean boot has fixed the IP issue do the following:

 

Repeat clean boot instructions again, ensure all MS services are hidden, enable half of the non MS services then re-boot. If the issue does not return do exactly the same again, this time only enable the bottom half of non MS services.

If the issue returns we know the issue is in the bottom half, so you now repeat again but only enable half of the bottom half. Keep doing that until you isolate the rogue sevice.

 

Let me know how you get on, I know it is a laborious task but it will locate the issue.

 

 

Kevin.

[pldreier]

Now this morning while checking email a random video opened up and started playing (screen shot attached - I could not find any information as far as ip address, etc as to where the video came from)

 

Also got 19 ESET warnings - screenshot attached of that as well.

 

Thanks for all of your assistance.

 

[pldreier]

Sorry to keep posting but realized that Malwarebytes was not running because it was disabled during the clean boot. I restarted it again now and the warnings about blocking the outbound IP address started back up again.

 

Then got 4 more Application Run-Security Warnings

Attached are the screen shots I took

 

 

[kevinf80]

Scan with Gmer rootkit scanner

 

Please download Gmer from Here by clicking on the "Download EXE" Button.

 

• Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
  
• If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following ...
   
          Sections
          IAT/EAT
          Show All ( should be unchecked by default )
   
  
• Leave everything else as it is.
  
• Close all other running Programs as well as your Browsers.
  
• Click the Scan button & wait for it to finish.
  
• Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop.
  

 

Please post the content of the ark.txt here.

 

 

**Caution**

Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

 

**If GMER crashes** Follow the instructions here and disable your security temporarily…

 

Next,

 

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

 

• 
  

Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes select "Report", log will open. Close the program > Don't Fix anything!
Post back the report which should also be located here:
C:\Programdata\RogueKiller\Logs <-------- W7/8
C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <-------XP

 

Let me see those logs please...

[pldreier]

Logs from Gmer and RogueKiller are attached.

Thanks

ark.txt

RKreport_SCN_10062014_123344.log

[kevinf80]

Logs are ok, not malicious...

 

Do you have access to another PC to create the Widows Defender Offline Tool, I give the instructions to load to a USB flash drive. It can also be loaded to a CD,

Download the tool from here :- http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline and save to the Desktop.

You will have to select the correct version for your system, either 32 or 64 bit

Run the tool, Windows 7 or Vista user right click and select "Run as Administrator"

Read the instructions in the new window and select "Next"

 

 

In the new window accept the agreement:

 

 

In the new window select your USB Flash Drive, then select "Next"

 

 

In the new window ensure you Flash drive is selected, if not click on "Refresh" then select "Next"

 

 

In the new window accept the formatting alert by selecting "Next"

 

 

Files will be Downloaded:

 

 

Files will be processed and created

 

 

Flash drive will be formatted and prepared

 

 

Files will be added to the Flash Drive and the tool will be created.

 

 

The procedure is finished and the Tool created, click on "Finish" to complete.

 

 

Plug the USB into the sick PC and boot up, if it does not boot from the flash drive change the boot options as required,  Use F12 as it boots, change options...

As it boots you`ll see files being loaded and the windows splash screen, eventually the tool will run a "Quick Scan" follow the prompts and deal with what it finds.

When complete do a full scan, deal with what it finds.

When finished, remove the USB stick then press the Esc key to boot into regular windows.

Navigate to the following file:

 

"C:\Windows\Windows Defender Offline\Support\MPLog-MM/DD/YYYY-HH/MM/SS .txt"

 

Open with notepad and copy and paste it into a reply.

 

Thaanks,

 

Kevin....

[pldreier]

Attached is the log file from latest scan (still can't copy and paste from Notepad for some reason???)

 

Just as an FYI - warnings that applications want to start up are still coming up and malwarebytes is still having to block the same outbound ip address periodically

Thanks

MPLog-10062014-143753.log

[kevinf80]

This is frustrating for sure, ok run the following:

 

Read the following link before we continue and run Combofix:

ComboFix usage, Questions, Help? - Look here

Next,

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from either of the following links :-

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

http://www.infospyware.net/antimalware/combofix/

• Ensure that Combofix is saved directly to the Desktop <--- Very important
• Disable all security programs as they will have a negative effect on Combofix, instructions available here  http://www.bleepingcomputer.com/forums/topic114351.html if required. Be aware the list may not have all programs listed, if you need more help please ask.
  
• Close any open browsers and any other programs you might have running
  
• Double click the icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)
  
• Instructions for running Combofix available here http://www.bleepingcomputer.com/combofix/how-to-use-combofix if required.
  
• If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
  
• When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review
  

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read here  http://thespykiller.co.uk/index.php?page=20 why  disabling autoruns is recommended.

*EXTRA NOTES*

• 
     
• If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
     
• If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
     
• If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)
  

Post the log in next reply please...

Kevin
 

[pldreier]

the combofix log is attached

Thanks

ComboFix.txt

[kevinf80]

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the Codebox below into it:

ClearJavaCache::

Save this as CFScript.txt, and as Type: All Files (*.*) in the same location as ComboFix.exe





Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply

 

Next,

 

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

 

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Full Scan

Perform a scan and  Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

 

1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter

notepad c:\windows\debug\mrt.log

 

Let me see those logs, also give update on any remaining issues or concerns....

 

Thanks,

 

Kevin..

[pldreier]

Combofix and MS Malicious Software removal logs both attached.

 

Those same applications keep wanting to run and Malwarebytes keeps blocking same outbound IP address.

Thanks

 

ComboFix.txt

mrt.log

[kevinf80]

Download Portable Windows Repair (all in one) from one of the following:

 

http://www.tweaking.com/content/page/windows_repair_all_in_one.html

http://www.majorgeeks.com/Tweaking.com_-_Windows_Repair_Portable_d7222.html

http://www.bleepingcomputer.com/download/windows-repair-all-in-one-portable/

 

Unzip the contents into a newly created folder on your desktop.

 

Open the folder, run the tool by right click on Repair_Windows (icon with red briefcase) select "Run as Administrator"

 

 

 

From the main GUI do the following:

 

 

Select Tab 3 and allow it to run Disk check

 

 

 

Select Tab 4 and allow it to run SFC

 

 

 

Select Tab 5 and Create System Restore Point

 

 

 

Select Start Repairs tab => Click the Start

 

 

 

The repairs window will open, Check the boxes as indicated, also the "Restart" option, then select Start...

 

 

 

DON'T use the computer while each scan is in progress.

 

Post the log, to access select "settings" tab > "open log folder" tab, log will be named _Windows_Repair_Log

 

 

 

 

Let me see that log,  do we see any improvement?

 

Kevin....

[pldreier]

the repair log is attached.

 

Still having Malwarebytes blocking IP address every few minutes.

I attached the application log for you showing all of the times it blocks it (not sure if that is helpful to you or not)

 

Thanks for sticking with me!

_Windows_Repair_Log.txt

malware.txt

[kevinf80]

Earlier in the thread when you noted Malwarebytes was still off, turning it back on reintroduced the IP block issue,  was the system still in a Clean Boot mode or back in Normal mode?

 

Next,

 

Download SystemLook from the following link below and save it to your Desktop. Use the correct version 32bit or 64bit.

http://jpshortstuff.247fixes.com/SystemLook_x64.exe      <<-   64 bit….

http://images.malwareremoval.com/jpshortstuff/SystemLook.exe  <<-  32 bit

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  
  

  :regfind*setup.application**Digital plugin SL*

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

 

Kevin......